5 ms·

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior …. Right, but "our system will protect you fro

by JadeNB 7y ago

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior …. Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

izacus 7y ago
What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? Because this criminal behaviour is also present in Linux, Windows and macOS. Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files between applications! Horrible! Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. If you want a jailed down device, it's fine: buy Apple. But that doesn't mean every pocket computer needs to be a crippled device.
- nerdjon 7y ago
  I would not consider my iPhone to be a crippled device. Just because these issues exist on a traditional computing device, does not mean we should continue that trend when a new type of platform exists (mobile). Plus, many of us likely have much more personal data on our phones that we ever had on our computers, especially location data for where you are all the time. This is absolutely a failure of the OS, but if you choose to accept that fine. But the issue is for those that are not in the tech community and don't realize there data is being mined when they specially chose the option to deny it.
- JadeNB 7y ago
  I expect my devices to uphold the security model they advertise. My desktop OS (macOS, for what it matters) doesn't ask me to approve permissions for apps, so I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them). On the other hand, for example, Firefox asks my permission before allowing sites to use the microphone or camera, and I expect it to enforce that. If sites can get access to my microphone or camera without my giving them permission, then Firefox has failed, even if those sites have got that access through unexpected means. I agree it's very hard to have a secure but useable general-purpose system—but pretending that you're offering such a system while not actually having the appropriate mechanisms to enforce it is, arguably, an even worse solution than offering an utterly locked-down system.
  - mirimir 7y ago
    Here's a simple experiment. On a Linux box, open your GUI text editor. Try to open /var/log/syslog. You will see "Permission denied". That's because only apps with root can access /var/*.
    - JadeNB 7y ago
      I agree that's a simple experiment. What does it demonstrate?
      - mirimir 7y ago
        You said this: > I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them). My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. So an app can't just decide to access and change some other app's settings.
        JadeNB 7y ago
        > My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. I'm running macOS, so this isn't directly relevant; I don't know much about Linux apps, but macOS ones often do some skulduggery—for example, Dropbox uses its root installation privileges to make some very hard-to-eradicate startup items (https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac https://applehelpwriter.com/2016/08/29/discovering-how-dropb...). Nonetheless, you are right that I was confusing "installed as root" with "has root privileges". > So an app can't just decide to access and change some other app's settings. Hopefully!—at least if this happens it's a bug.
  - JadeNB 7y ago
    Just as an added point for my claim that this position is not hypocritical, I consider https://news.ycombinator.com/item?id=20387298 https://news.ycombinator.com/item?id=20387298 to be a flaw in the macOS security model, for which the OS deserves blame, and not just an instance of poor app design (although it is clearly that).
- scarface74 7y ago
  What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? On iOS, you have to separately allow image access and access to location data stored as part of the image.
- autoexec 7y ago
  > Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. Unlike a desktop computer Android prevents you from taking steps to protect yourself. Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Google designed their OS to collect and leak your data. It's why their permissions system (even when working as designed) is garbage. Google doesn't want you to have the ability to protect yourself. It assumes responsibility and lets you (sometimes) disable some permissions from some apps (but not others) at their discretion. No one does that on my desktop computers. Most people's phones are filled with apps they don't want but aren't even allowed to uninstall.
  - lern_too_spel 7y ago
    > Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/ https://f-droid.org/en/packages/eu.faircode.netguard/
    - autoexec 7y ago
      It looks like netguard is a VPN service, not a true firewall. A firewall on my desktop doesn't require me to route all my traffic through a VPN. Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q https://imgur.com/a/2YG7Q
      - lern_too_spel 7y ago
        Nope. It runs solely on the device. How else would it know which app is making the network request? What are you basing your strange claims on? > Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q https://imgur.com/a/2YG7Q Netguard is open source (with a license not supported on iOS: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard), so there is no reason to use a build that shows ads. Alternatively, as I said earlier, there are multiple firewall apps you could use that don't require root.

by JadeNB 7y ago

izacus 7y ago

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? Because this criminal behaviour is also present in Linux, Windows and macOS. Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files between applications! Horrible! Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. If you want a jailed down device, it's fine: buy Apple. But that doesn't mean every pocket computer needs to be a crippled device.

nerdjon 7y ago
I would not consider my iPhone to be a crippled device. Just because these issues exist on a traditional computing device, does not mean we should continue that trend when a new type of platform exists (mobile). Plus, many of us likely have much more personal data on our phones that we ever had on our computers, especially location data for where you are all the time. This is absolutely a failure of the OS, but if you choose to accept that fine. But the issue is for those that are not in the tech community and don't realize there data is being mined when they specially chose the option to deny it.
JadeNB 7y ago
I expect my devices to uphold the security model they advertise. My desktop OS (macOS, for what it matters) doesn't ask me to approve permissions for apps, so I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them). On the other hand, for example, Firefox asks my permission before allowing sites to use the microphone or camera, and I expect it to enforce that. If sites can get access to my microphone or camera without my giving them permission, then Firefox has failed, even if those sites have got that access through unexpected means. I agree it's very hard to have a secure but useable general-purpose system—but pretending that you're offering such a system while not actually having the appropriate mechanisms to enforce it is, arguably, an even worse solution than offering an utterly locked-down system.
- mirimir 7y ago
  Here's a simple experiment. On a Linux box, open your GUI text editor. Try to open /var/log/syslog. You will see "Permission denied". That's because only apps with root can access /var/*.
  - JadeNB 7y ago
    I agree that's a simple experiment. What does it demonstrate?
    - mirimir 7y ago
      You said this: > I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them). My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. So an app can't just decide to access and change some other app's settings.
      - JadeNB 7y ago
        > My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. I'm running macOS, so this isn't directly relevant; I don't know much about Linux apps, but macOS ones often do some skulduggery—for example, Dropbox uses its root installation privileges to make some very hard-to-eradicate startup items (https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac https://applehelpwriter.com/2016/08/29/discovering-how-dropb...). Nonetheless, you are right that I was confusing "installed as root" with "has root privileges". > So an app can't just decide to access and change some other app's settings. Hopefully!—at least if this happens it's a bug.
- JadeNB 7y ago
  Just as an added point for my claim that this position is not hypocritical, I consider https://news.ycombinator.com/item?id=20387298 https://news.ycombinator.com/item?id=20387298 to be a flaw in the macOS security model, for which the OS deserves blame, and not just an instance of poor app design (although it is clearly that).
scarface74 7y ago
What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? On iOS, you have to separately allow image access and access to location data stored as part of the image.
autoexec 7y ago
> Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. Unlike a desktop computer Android prevents you from taking steps to protect yourself. Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Google designed their OS to collect and leak your data. It's why their permissions system (even when working as designed) is garbage. Google doesn't want you to have the ability to protect yourself. It assumes responsibility and lets you (sometimes) disable some permissions from some apps (but not others) at their discretion. No one does that on my desktop computers. Most people's phones are filled with apps they don't want but aren't even allowed to uninstall.
- lern_too_spel 7y ago
  > Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/ https://f-droid.org/en/packages/eu.faircode.netguard/
  - autoexec 7y ago
    It looks like netguard is a VPN service, not a true firewall. A firewall on my desktop doesn't require me to route all my traffic through a VPN. Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q https://imgur.com/a/2YG7Q
    - lern_too_spel 7y ago
      Nope. It runs solely on the device. How else would it know which app is making the network request? What are you basing your strange claims on? > Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q https://imgur.com/a/2YG7Q Netguard is open source (with a license not supported on iOS: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard), so there is no reason to use a build that shows ads. Alternatively, as I said earlier, there are multiple firewall apps you could use that don't require root.